Commit c37de519 authored by Mark Thompson's avatar Mark Thompson

vorbis: Reorder conditions to avoid possible overread

This can trigger a single-byte overread if the codebook has the maximum
number of entries.

Fixes #6743.
parent 242d8c87
...@@ -58,7 +58,7 @@ int ff_vorbis_len2vlc(uint8_t *bits, uint32_t *codes, unsigned num) ...@@ -58,7 +58,7 @@ int ff_vorbis_len2vlc(uint8_t *bits, uint32_t *codes, unsigned num)
uint32_t exit_at_level[33] = { 404 }; uint32_t exit_at_level[33] = { 404 };
unsigned i, j, p, code; unsigned i, j, p, code;
for (p = 0; (bits[p] == 0) && (p < num); ++p) for (p = 0; (p < num) && (bits[p] == 0); ++p)
; ;
if (p == num) if (p == num)
return 0; return 0;
...@@ -71,7 +71,7 @@ int ff_vorbis_len2vlc(uint8_t *bits, uint32_t *codes, unsigned num) ...@@ -71,7 +71,7 @@ int ff_vorbis_len2vlc(uint8_t *bits, uint32_t *codes, unsigned num)
++p; ++p;
for (i = p; (bits[i] == 0) && (i < num); ++i) for (i = p; (i < num) && (bits[i] == 0); ++i)
; ;
if (i == num) if (i == num)
return 0; return 0;
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment